adwind | 7a02319dbd8e5fc7c9bc6c6377d44856229c5fbaa206b78493803a4e5a2c531d

General

Target
7a02319dbd8e5fc7c9bc6c6377d44856229c5fbaa206b78493803a4e5a2c531d.jar
Size 62KB
Sample221029-bv9fjsfbe7
SHA256 7a02319dbd8e5fc7c9bc6c6377d44856229c5fbaa206b78493803a4e5a2c531d
MD5 d9b6c899f8112a40131865f73e1ea9c9
SHA1 194e24c21f616aba91b10c9b108c22a6bdf5c497
SHA512 08548b4e90ecbb334388991faa34adea79110ce21db1054a99d284d8e476c456db8f38f27dcaf394829e43978082081ea459654b508611a86a84b5ab53afa111
SSDEEP 1536:tFaDYQKV+r8TWnf0yL84UFE0YcmF15RFA3ep/NN/wz8:tXQKVu8TWfWL1YFPbAkNlwA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

adwind evasion persistence trojan

Malware Config

Signatures

AdWind
A Java-based RAT family operated as malware-as-a-service.
trojan adwind

JAR file contains resources related to AdWind 1 IoCs

This JAR file potentially contains loader stubs used by the AdWind RAT.

resource	yara_rule
behavioral1/files/0x000a000000013a31-72.dat	family_adwind_stub

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
1716	attrib.exe
1780	attrib.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\asdasdasd = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\asdasd\\asda.jar\""	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\asdasdasd = "\"C:\\Program Files\\Java\\jre7\\bin\\javaw.exe\" -jar \"C:\\Users\\Admin\\AppData\\Roaming\\asdasd\\asda.jar\""	reg.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\asdasd\Desktop.ini	java.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\asdasd\Desktop.ini	attrib.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1516	reg.exe
584	reg.exe
640	reg.exe
1976	reg.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1340	java.exe
1784	javaw.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 1516	1340	java.exe	28
PID 1340 wrote to memory of 1516	1340	java.exe	28
PID 1340 wrote to memory of 1516	1340	java.exe	28
PID 1340 wrote to memory of 584	1340	java.exe	29
PID 1340 wrote to memory of 584	1340	java.exe	29
PID 1340 wrote to memory of 584	1340	java.exe	29
PID 1340 wrote to memory of 1716	1340	java.exe	31
PID 1340 wrote to memory of 1716	1340	java.exe	31
PID 1340 wrote to memory of 1716	1340	java.exe	31
PID 1340 wrote to memory of 1780	1340	java.exe	30
PID 1340 wrote to memory of 1780	1340	java.exe	30
PID 1340 wrote to memory of 1780	1340	java.exe	30
PID 1340 wrote to memory of 1784	1340	java.exe	32
PID 1340 wrote to memory of 1784	1340	java.exe	32
PID 1340 wrote to memory of 1784	1340	java.exe	32
PID 1784 wrote to memory of 640	1784	javaw.exe	33
PID 1784 wrote to memory of 640	1784	javaw.exe	33
PID 1784 wrote to memory of 640	1784	javaw.exe	33
PID 1784 wrote to memory of 1976	1784	javaw.exe	35
PID 1784 wrote to memory of 1976	1784	javaw.exe	35
PID 1784 wrote to memory of 1976	1784	javaw.exe	35
PID 1784 wrote to memory of 1900	1784	javaw.exe	37
PID 1784 wrote to memory of 1900	1784	javaw.exe	37
PID 1784 wrote to memory of 1900	1784	javaw.exe	37

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1780	attrib.exe
1716	attrib.exe
1900	attrib.exe

C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\7a02319dbd8e5fc7c9bc6c6377d44856229c5fbaa206b78493803a4e5a2c531d.jar
1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\system32\reg.exe
  reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v asdasdasd /t REG_SZ /d "\"C:\Program Files\Java\jre7\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\asdasd\asda.jar\"" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:1516
- C:\Windows\system32\reg.exe
  reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v asdasdasd /f
  2⤵
  - Modifies registry key
  PID:584
- C:\Windows\system32\attrib.exe
  attrib +s +h +r "C:\Users\Admin\AppData\Roaming\asdasd"
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1780
- C:\Windows\system32\attrib.exe
  attrib +s +h +r "C:\Users\Admin\AppData\Roaming\asdasd\*.*"
  2⤵
  - Sets file to hidden
  - Drops desktop.ini file(s)
  - Views/modifies file attributes
  PID:1716
- C:\Program Files\Java\jre7\bin\javaw.exe
  "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Roaming\asdasd\asda.jar"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\system32\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v asdasdasd /t REG_SZ /d "\"C:\Program Files\Java\jre7\bin\javaw.exe\" -jar \"C:\Users\Admin\AppData\Roaming\asdasd\asda.jar\"" /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:640
- - C:\Windows\system32\reg.exe
    reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v asdasdasd /f
    3⤵
    - Modifies registry key
    PID:1976
- - C:\Windows\system32\attrib.exe
    attrib +H C:\Users\Admin\.Plugins3
    3⤵
    - Views/modifies file attributes
    PID:1900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Desktop.ini

Path C:\Users\Admin\AppData\Roaming\asdasd\Desktop.ini
Size 63B
SHA256 2f65fa9c7ed712f493782abf91467f869419a2f8b5adf23b44019c08190fa3f3
MD5 e783bdd20a976eaeaae1ff4624487420
SHA1 c2a44fab9df00b3e11582546b16612333c2f9286
SHA512 8c883678e4625ef44f4885b8c6d7485196774f9cb0b9eee7dd18711749bcae474163df9965effcd13ecd1a33cd7265010c152f8504d6013e4f4d85d68a901a80
MD5 SHA1 SHA512

Submit Download

asda.jar

Path C:\Users\Admin\AppData\Roaming\asdasd\asda.jar
Size 62KB
SHA256 7a02319dbd8e5fc7c9bc6c6377d44856229c5fbaa206b78493803a4e5a2c531d
MD5 d9b6c899f8112a40131865f73e1ea9c9
SHA1 194e24c21f616aba91b10c9b108c22a6bdf5c497
SHA512 08548b4e90ecbb334388991faa34adea79110ce21db1054a99d284d8e476c456db8f38f27dcaf394829e43978082081ea459654b508611a86a84b5ab53afa111
SSDEEP 1536:tFaDYQKV+r8TWnf0yL84UFE0YcmF15RFA3ep/NN/wz8:tXQKVu8TWfWL1YFPbAkNlwA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1340-64-0x0000000002120000-0x0000000005120000-memory.dmp

Download

memory/1340-54-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Download

memory/1784-88-0x0000000002020000-0x0000000005020000-memory.dmp

Download

memory/1784-95-0x0000000002020000-0x0000000005020000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads